What is a CBOM?
A CBOM shows what cryptography a system depends on.
A CBOM is useful when it supports decisions.
It is weak when it is only a technical export that nobody can act on.
The Page in One Picture
Discover
Find cryptography in systems, traffic, certificates, source code, vendors, products, and configurations.
Organise
Connect findings to systems, owners, business use, data lifetime, vendors, and risk.
Structure
Create a CBOM: a structured record of cryptographic components and dependencies.
Decide
Prioritise what needs review, vendor follow-up, testing, replacement, or migration.
find it → organise it → structure it → act on it
What a CBOM Is
A structured record
A CBOM records cryptographic information in a way that can be reviewed, shared, updated, and used for planning.
The exact format matters less than the quality of the information.
A clean file with poor context is not a good CBOM.
Not just a certificate scan
Certificate scans are useful, but they are only one view.
A company also needs to understand cryptography in:
- internal services
- VPNs
- identity systems
- cloud platforms
- software updates
- code signing
- embedded devices
- network appliances
- vendor products
- long-term archives
For PQC readiness, the hidden parts often matter most.
Business context
Cryptographic use
Technical detail
Ownership
Decision
system → cryptography → owner → risk → action
The Useful Mental Model
CBOM is not the first step.
It usually comes after discovery work.
| Step | What It Does | Output |
|---|---|---|
| Crypto discovery | Finds where cryptography is used. | Raw findings. |
| Cryptographic inventory | Organises findings by system, owner, vendor, and risk. | Operational view. |
| CBOM | Structures cryptographic components and dependencies. | Shareable record. |
| Readiness planning | Decides what to review or change first. | Roadmap and actions. |
Discovery finds it.
Inventory makes it understandable.
CBOM makes it structured.
Readiness work makes it actionable.
Example CBOM Record
Customer portal
Customer login and account access
TLS certificate and key exchange
TLS
ECDSA certificate; ECDHE key exchange; AES symmetric encryption
Web platform team
External hosting provider
Customer account data
Medium to long
Public-key cryptography used for identity and key exchange
Certificate and TLS stack controlled partly by vendor
Review vendor roadmap and test supported options
This is a simplified example.
The important point is not the exact format.
The important point is the connection between technical detail and a decision.
Advanced Reader Note — CycloneDX and SPDX
CycloneDX is relevant because it has explicit support for CBOM-style information.
CycloneDX
In simple terms, it can represent cryptographic assets such as:
This matters when a CBOM needs to become machine-readable and tool-supported.
Practical starting point
But a company does not need a perfect CycloneDX CBOM on day one.
For many organisations, the practical starting point is still:
SPDX
SPDX is important in software supply-chain work and SBOM discussions.
For this page, it should be treated as SBOM context, not as the main CBOM answer.
BOM standard with explicit CBOM capability.
Main CBOM format reference.SBOM and software supply-chain metadata.
Useful SBOM context.Early practical inventory work.
Useful starting point, not mature automation.Good CBOM vs Weak CBOM
Good CBOM
Connects cryptography to real systems.
Shows owners and vendors.
Includes evidence source.
Supports prioritisation.
Can be updated over time.
Helps ask better vendor questions.
Can move towards machine-readable structure.
Supports migration planning.
Weak CBOM
Lists algorithms without context.
Has no clear owner.
Gives unexplained findings.
Treats all findings as equal.
Is a one-off PDF.
Accepts vague “quantum-safe” claims.
Cannot be reused or automated.
Does not lead to action.
Why CBOM Matters for PQC
Post-quantum migration is not only about choosing new algorithms.
It is also about finding where old cryptographic assumptions are built into systems.
PQC-Relevant Areas
A CBOM helps these areas become visible.
Without that visibility, a company may only fix the obvious parts and miss the difficult ones.
Vendor Questions
A CBOM helps procurement, compliance, and security teams ask better supplier questions.
Better Questions
- Can you provide cryptographic inventory or CBOM information?
- Which public-key algorithms are used in this product?
- Where do you use RSA, Diffie-Hellman, ECDH, ECDSA, or other elliptic-curve methods?
- Which cryptographic functions are configurable?
- Which are hardcoded?
- Do you have a post-quantum migration roadmap?
- Will you support hybrid or post-quantum options where relevant?
- What evidence can you provide?
- What is outside the scope of your roadmap?
That question is too broad.
It invites a vague answer.
A better question asks for evidence, scope, and a roadmap.
Common Misunderstandings
“A CBOM is just a list of algorithms.”
No.
A useful CBOM connects algorithms to systems, owners, vendors, certificates, protocols, business use, and risk.
An algorithm name without context is not enough.
“If we generate a CycloneDX CBOM, we are ready for PQC.”
No.
A CycloneDX CBOM can be a strong way to represent cryptographic information.
But readiness still needs:
- good discovery
- current evidence
- risk review
- ownership
- vendor follow-up
- testing
- migration planning
- change management
- crypto-agility
A format can support the work.
It cannot replace the work.
Decision Box
When Is a CBOM Useful?
A CBOM is useful when it helps answer at least one of these questions:
- What cryptography do we use?
- Where is it used?
- Who owns it?
- Which vendor controls it?
- Which parts may be exposed to quantum risk?
- Which systems are difficult to change?
- What should we review first?
- Can we keep this information updated?
If it cannot help answer these questions, it is probably just documentation.
What to Remember
One-Sentence Summary
A CBOM turns hidden cryptography into structured information that can support risk, vendor, and migration decisions.
Three Key Points
- A CBOM must connect cryptography to real systems and owners.
- CycloneDX is relevant because it supports CBOM-style machine-readable representation, but the format is not the whole strategy.
- For PQC readiness, a CBOM is not the finish line. It is a visibility layer that supports better decisions.